Require MFA

CA400-GuestUsers-IdentityProtection-AnyApp-AnyPlatform-MFA

Require MFA

About this policy

The CA400-GuestUsers-IdentityProtection-AnyApp-AnyPlatform-MFA policy requires multifactor authentication from every flavour of external identity, covering B2B collaboration guests and members, direct connect users, internal guests, service providers and other external users. It spans all cloud apps and platforms. Guests authenticate with credentials your organisation does not control, so an MFA challenge on your side is the one assurance you can enforce yourself. You can honour MFA from a trusted home tenant through cross tenant access settings if you choose.

Policy conditions

Users: Specific users
Apps: All cloud apps

JSON template

{
  "@odata.context": "https://graph.microsoft.com/beta/$metadata#identity/conditionalAccess/policies/$entity",
  "@odata.type": "#microsoft.graph.conditionalAccessPolicy",
  "@odata.id": "identity/conditionalAccess/policies('1ccca3dd-93cb-4c14-9ae1-abe557971060')",
  "@odata.editLink": "identity/conditionalAccess/policies('1ccca3dd-93cb-4c14-9ae1-abe557971060')",
  "templateId": "a4072ac0-722b-4991-981b-7f9755daef14",
  "displayName": "CA400-GuestUsers-IdentityProtection-AnyApp-AnyPlatform-MFA",
  "createdDateTime@odata.type": "#DateTimeOffset",
  "modifiedDateTime@odata.type": "#DateTimeOffset",
  "state@odata.type": "#microsoft.graph.conditionalAccessPolicyState",
  "state": "enabled",
  "deletedDateTime": null,
  "partialEnablementStrategy": null,
  "sessionControls": null,
  "conditions": {
    "@odata.type": "#microsoft.graph.conditionalAccessConditionSet",
    "userRiskLevels@odata.type": "#Collection(microsoft.graph.riskLevel)",
    "userRiskLevels": [],
    "signInRiskLevels@odata.type": "#Collection(microsoft.graph.riskLevel)",
    "signInRiskLevels": [],
    "clientAppTypes@odata.type": "#Collection(microsoft.graph.conditionalAccessClientApp)",
    "clientAppTypes": [
      "all"
    ],
    "platforms": null,
    "locations": null,
    "times": null,
    "deviceStates": null,
    "devices": null,
    "clientApplications": null,
    "agents": null,
    "applications": {
      "@odata.type": "#microsoft.graph.conditionalAccessApplications",
      "includeApplications@odata.type": "#Collection(String)",
      "includeApplications": [
        "All"
      ],
      "excludeApplications@odata.type": "#Collection(String)",
      "excludeApplications": [],
      "includeUserActions@odata.type": "#Collection(String)",
      "includeUserActions": [],
      "includeAuthenticationContextClassReferences@odata.type": "#Collection(String)",
      "includeAuthenticationContextClassReferences": [],
      "applicationFilter": null
    },
    "users": {
      "@odata.type": "#microsoft.graph.conditionalAccessUsers",
      "includeUsers@odata.type": "#Collection(String)",
      "includeUsers": [],
      "excludeUsers@odata.type": "#Collection(String)",
      "excludeUsers": [],
      "includeGroups@odata.type": "#Collection(String)",
      "includeGroups": [],
      "excludeGroups@odata.type": "#Collection(String)",
      "excludeGroups": [
        "2802b872-ccfb-4b29-a9a9-459808dfb11b",
        "349156c1-2fb1-4ffa-9cd3-5c4418e24e4c"
      ],
      "includeRoles@odata.type": "#Collection(String)",
      "includeRoles": [],
      "excludeRoles@odata.type": "#Collection(String)",
      "excludeRoles": [],
      "excludeGuestsOrExternalUsers": null,
      "includeGuestsOrExternalUsers": {
        "@odata.type": "#microsoft.graph.conditionalAccessGuestsOrExternalUsers",
        "guestOrExternalUserTypes@odata.type": "#microsoft.graph.conditionalAccessGuestOrExternalUserTypes",
        "guestOrExternalUserTypes": "internalGuest,b2bCollaborationGuest,b2bCollaborationMember,b2bDirectConnectUser,otherExternalUser,serviceProvider",
        "externalTenants": {
          "@odata.type": "#microsoft.graph.conditionalAccessAllExternalTenants",
          "membershipKind@odata.type": "#microsoft.graph.conditionalAccessExternalTenantsMembershipKind",
          "membershipKind": "all"
        }
      }
    }
  },
  "grantControls": {
    "@odata.type": "#microsoft.graph.conditionalAccessGrantControls",
    "operator": "OR",
    "builtInControls@odata.type": "#Collection(microsoft.graph.conditionalAccessGrantControl)",
    "builtInControls": [
      "mfa"
    ],
    "customAuthenticationFactors@odata.type": "#Collection(String)",
    "customAuthenticationFactors": [],
    "termsOfUse@odata.type": "#Collection(String)",
    "termsOfUse": [],
    "authenticationStrength@odata.context": "https://graph.microsoft.com/beta/$metadata#identity/conditionalAccess/policies('1ccca3dd-93cb-4c14-9ae1-abe557971060')/grantControls/authenticationStrength/$entity",
    "authenticationStrength@odata.associationLink": "https://graph.microsoft.com/beta/identity/conditionalAccess/policies('1ccca3dd-93cb-4c14-9ae1-abe557971060')/grantControls/authenticationStrength/$ref",
    "authenticationStrength@odata.navigationLink": "https://graph.microsoft.com/beta/identity/conditionalAccess/policies('1ccca3dd-93cb-4c14-9ae1-abe557971060')/grantControls/authenticationStrength",
    "authenticationStrength": null
  },
  "#microsoft.graph.restore": {
    "title": "microsoft.graph.restore",
    "target": "https://graph.microsoft.com/beta/identity/conditionalAccess/policies('1ccca3dd-93cb-4c14-9ae1-abe557971060')/microsoft.graph.restore"
  },
  "Tag": "jv-CAF-2026.2.1",
  "summary": "The CA400-GuestUsers-IdentityProtection-AnyApp-AnyPlatform-MFA policy requires multifactor authentication from every flavour of external identity, covering B2B collaboration guests and members, direct connect users, internal guests, service providers and other external users. It spans all cloud apps and platforms. Guests authenticate with credentials your organisation does not control, so an MFA challenge on your side is the one assurance you can enforce yourself. You can honour MFA from a trusted home tenant through cross tenant access settings if you choose."
}